Input & Protocol Manipulation

Use When

• The main question is parser behavior, encoding, method override, header trust, smuggling, serialization, or injection capability.
• A request transformation may cross a parser, protocol, or trust boundary.

Handoff Criteria

• Hand off to pentest-authentication-authorization-review or pentest-advanced-access-control-auditor when an input anomaly becomes an authorization claim.
• Hand off to pentest-business-logic-abuse when the exploitability depends on workflow state.
• Hand off to pentest-evidence-structuring-report-synthesis when validation is complete.

Output Schema

• Test matrix: vector, payload class, expected secure behavior, observed behavior
• Validation state: hypothesis, confirmed, rejected
• Minimal reproducible request set